<html>


<meta http-equiv="Content-Type" content="text/html;charset=UTF-8">
<head>

<meta name="GENERATOR" content="Microsoft FrontPage 6.0">
<link href="Metafiles_files/topic000.css" rel="stylesheet" type="text/css">
<title>Metafiles</title>
</head>

<body>

<h1>Metafiles</h1>

<p>The first 12&nbsp;records in MFT are always occupied by service metafiles: $MFT (the $MFT proper), $MFTMirr ($MFT mirror), $LogFile (transaction log), $Volume (information about volume), $AttrDef (defined attributes), '.' (root directory), $Bitmap (free space map), $Boot (system loader), $BadClus (list of bad clusters), etc. Every metafile is responsible for some aspect of system functioning. The table below lists the currently used metafiles and their purposes.</p>

<p>Four first records are so important that they are duplicated in a special $MFTMirr file located approximately in the middle of a drive (precise location is stored in boot sector at offset 38h bytes from its beginning). Contrary to its name, $MFTMirr is not a mirror of the whole $MFT file, it is just a copy of its first four elements.</p>

<p>Records from 12 to 15 are marked as used, but in fact they are empty. Records 16-23 are not used, they are marked as unused. </p>

<p>Beginning with record 24, the user files and directories are located. Four metafiles, which appeared in W2K&nbsp;($ObjId, $Quota, $Reparse and $UsnJrnl) can be located in any record with the number equal to 24 or greater (file record numbers are counted from zero).</p>

<p>NTFS service files (metafiles)</p>

<p><img src="Metafiles_files/metafile.gif"><br>
</p>
</body>
</html>

<!-- This document saved from http://www.pc-3000flash.com/eng/help/help_information/ntfs/metafiles.htm -->
